I have a view with 2 blocks (similar but different in layout) on the page that look like this.
When the page loads, I get results in my chart and table, but they are incomplete. If I change the timerange using the picker, I get more incomplete.
For instance, if I select "24 hours" I get results in the chart and table that go back to approximately noon today. If I select "7 days" I get data that goes back to approximately sept 16th.
If I manually run any of the searches, I get all the results.
When I used firebug's net tab and the time picker, I see a POST jobs followed by a POST control which includes an action=cancel.
I don't know if that is the culprit, but I can't explain why it wouldn't be receiving all the results as it should.
It's not anything being cancelled, it's just a limitation of postProcess that you have to be careful with.
First though, there's a higher order problem with this view. Lets take care of that first.
1) If you picture the data flowing down and inward through the modules, searches get dispatched as soon as the data hits a module that needs the search to be running. So for example HiddenSearch, HiddenPostProcess, TimeRangePicker etc.. -- these modules do not require a running search so nothing will get kicked off. On the other hand JobProgressIndicator and SimpleResultsTable need the search to be running or else they're meaningless so if the package of search data hits those points and the search hasnt been kicked off already, it'll get kicked off there.
Given that info, take another look at your XML and you'll see that even though you have two HiddenPostProcesses, the searches wont get dispatched until the data is in the subtrees-- so you're not getting the benefit of HiddenPostProcess and you're actually going to have two searches running.
What you want instead is probably a single JobProgressIndicator that's higher up in the hierarchy, and that has both HiddenPostProcess modules downstream.
2) OK. The deal with postProcess is that it cant work with what it doesnt have. Splunk wont keep every _raw value of every event around -- in fact it will only keep 50,000 or so.
So the timechart commands on your HiddenPostProcess are going to be operating on incomplete input. The answer is simple although unintuitive-- change the base search to be able to provide complete information to both.
So for example, if you wanted a single search to feed both
This technique is often referred to as the 'datacube' technique, cause you're building a higher dimensional cube of data, and then using postProcess to draw projections from that cube to create the end reports.
There's a page in the docs about this -- http://www.splunk.com/base/Documentation/4.1.5/Developer/PostProcess
Note in particular that you have to worry about the rows outputted by the stats command, where 'count' may be >1. this is what the